@cdxgen/cdxgen 0.0.1 → 13.0.1

package/lib/third-party/arborist/lib/spec-from-lock.js

@@ -0,0 +1,34 @@
+import npa from "npm-package-arg";
+
+// extracted from npm v6 lib/install/realize-shrinkwrap-specifier.js
+const specFromLock = (name, lock, where) => {
+  try {
+    if (lock.version) {
+      const spec = npa.resolve(name, lock.version, where);
+      if (lock.integrity || spec.type === "git") {
+        return spec;
+      }
+    }
+    if (lock.from) {
+      // legacy metadata includes "from", but not integrity
+      const spec = npa.resolve(name, lock.from, where);
+      if (spec.registry && lock.version) {
+        return npa.resolve(name, lock.version, where);
+      } else if (!lock.resolved) {
+        return spec;
+      }
+    }
+    if (lock.resolved) {
+      return npa.resolve(name, lock.resolved, where);
+    }
+  } catch {
+    // ignore errors
+  }
+  try {
+    return npa.resolve(name, lock.version, where);
+  } catch {
+    return {};
+  }
+};
+
+export default specFromLock;

package/lib/third-party/arborist/lib/tree-check.js

@@ -0,0 +1,165 @@
+import debug from "./debug.js";
+
+const checkTree = (tree, checkUnreachable = true) => {
+  const log = [["START TREE CHECK", tree.path]];
+
+  // this can only happen in tests where we have a "tree" object
+  // that isn't actually a tree.
+  if (!tree.root || !tree.root.inventory) {
+    return tree;
+  }
+
+  const { inventory } = tree.root;
+  const seen = new Set();
+  const check = (node, via = tree, viaType = "self") => {
+    log.push([
+      "CHECK",
+      node && node.location,
+      via && via.location,
+      viaType,
+      "seen=" + seen.has(node),
+      "promise=" + !!(node && node.then),
+      "root=" + !!(node && node.isRoot),
+    ]);
+
+    if (!node || seen.has(node) || node.then) {
+      return;
+    }
+
+    seen.add(node);
+
+    if (node.isRoot && node !== tree.root) {
+      throw Object.assign(new Error("double root"), {
+        node: node.path,
+        realpath: node.realpath,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        log,
+      });
+    }
+
+    if (node.root !== tree.root) {
+      throw Object.assign(new Error("node from other root in tree"), {
+        node: node.path,
+        realpath: node.realpath,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        otherRoot: node.root && node.root.path,
+        log,
+      });
+    }
+
+    if (!node.isRoot && node.inventory.size !== 0) {
+      throw Object.assign(new Error("non-root has non-zero inventory"), {
+        node: node.path,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        inventory: [...node.inventory.values()].map((node) => [
+          node.path,
+          node.location,
+        ]),
+        log,
+      });
+    }
+
+    if (!node.isRoot && !inventory.has(node) && !node.dummy) {
+      throw Object.assign(new Error("not in inventory"), {
+        node: node.path,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        log,
+      });
+    }
+
+    const devEdges = [...node.edgesOut.values()].filter((e) => e.dev);
+    if (!node.isTop && devEdges.length) {
+      throw Object.assign(new Error("dev edges on non-top node"), {
+        node: node.path,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        devEdges: devEdges.map((e) => [e.type, e.name, e.spec, e.error]),
+        log,
+      });
+    }
+
+    if (
+      node.path === tree.root.path &&
+      node !== tree.root &&
+      !tree.root.isLink
+    ) {
+      throw Object.assign(new Error("node with same path as root"), {
+        node: node.path,
+        tree: tree.path,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        log,
+      });
+    }
+
+    if (!node.isLink && node.path !== node.realpath) {
+      throw Object.assign(new Error("non-link with mismatched path/realpath"), {
+        node: node.path,
+        tree: tree.path,
+        realpath: node.realpath,
+        root: tree.root.path,
+        via: via.path,
+        viaType,
+        log,
+      });
+    }
+
+    const { parent, fsParent, target } = node;
+    check(parent, node, "parent");
+    check(fsParent, node, "fsParent");
+    check(target, node, "target");
+    log.push(["CHILDREN", node.location, ...node.children.keys()]);
+    for (const kid of node.children.values()) {
+      check(kid, node, "children");
+    }
+    for (const kid of node.fsChildren) {
+      check(kid, node, "fsChildren");
+    }
+    for (const link of node.linksIn) {
+      check(link, node, "linksIn");
+    }
+    for (const top of node.tops) {
+      check(top, node, "tops");
+    }
+    log.push(["DONE", node.location]);
+  };
+  check(tree);
+  if (checkUnreachable) {
+    for (const node of inventory.values()) {
+      if (!seen.has(node) && node !== tree.root) {
+        throw Object.assign(new Error("unreachable in inventory"), {
+          node: node.path,
+          realpath: node.realpath,
+          location: node.location,
+          root: tree.root.path,
+          tree: tree.path,
+          log,
+        });
+      }
+    }
+  }
+  return tree;
+};
+
+// should only ever run this check in debug mode
+let selected = (tree) => tree;
+debug(() => {
+  selected = checkTree;
+});
+
+export default (tree, checkUnreachable) => selected(tree, checkUnreachable);

package/lib/third-party/arborist/lib/validate-npm-package-name.js

@@ -0,0 +1,107 @@
+// Dependency-free reimplementation of validate-npm-package-name 8.x, used by
+// package-extensions.js to reject malformed packageExtensions selectors.
+//
+// The rules and the result shape match the published package: `errors` are
+// conditions npm has never allowed, `warnings` are conditions that were once
+// legal and now only disqualify a name from being newly published. Both keys
+// are omitted when empty.
+import { builtinModules } from "node:module";
+
+const scopedPackagePattern = /^(?:@([^/]+?)\/)?([^/]+?)$/;
+const exclusionList = new Set(["node_modules", "favicon.ico"]);
+const builtins = new Set(builtinModules.map((m) => m.toLowerCase()));
+
+function done(warnings, errors) {
+  const result = {
+    validForNewPackages: errors.length === 0 && warnings.length === 0,
+    validForOldPackages: errors.length === 0,
+    warnings,
+    errors,
+  };
+  if (!result.warnings.length) {
+    delete result.warnings;
+  }
+  if (!result.errors.length) {
+    delete result.errors;
+  }
+  return result;
+}
+
+/**
+ * Validate a package name.
+ *
+ * @param {*} name Candidate package name
+ * @returns {{validForNewPackages: boolean, validForOldPackages: boolean, warnings?: string[], errors?: string[]}}
+ */
+export default function validate(name) {
+  const warnings = [];
+  const errors = [];
+
+  if (name === null) {
+    errors.push("name cannot be null");
+    return done(warnings, errors);
+  }
+  if (name === undefined) {
+    errors.push("name cannot be undefined");
+    return done(warnings, errors);
+  }
+  if (typeof name !== "string") {
+    errors.push("name must be a string");
+    return done(warnings, errors);
+  }
+
+  if (!name.length) {
+    errors.push("name length must be greater than zero");
+  }
+  if (name.startsWith(".")) {
+    errors.push("name cannot start with a period");
+  }
+  if (name.startsWith("-")) {
+    errors.push("name cannot start with a hyphen");
+  }
+  if (name.startsWith("_")) {
+    errors.push("name cannot start with an underscore");
+  }
+  if (name.trim() !== name) {
+    errors.push("name cannot contain leading or trailing spaces");
+  }
+  for (const excludedName of exclusionList) {
+    if (name.toLowerCase() === excludedName) {
+      errors.push(`${excludedName} is not a valid package name`);
+    }
+  }
+
+  if (builtins.has(name.toLowerCase())) {
+    warnings.push(`${name} is a core module name`);
+  }
+  if (name.length > 214) {
+    warnings.push("name can no longer contain more than 214 characters");
+  }
+  if (name.toLowerCase() !== name) {
+    warnings.push("name can no longer contain capital letters");
+  }
+  if (/[~'!()*]/.test(name.split("/").slice(-1)[0])) {
+    warnings.push('name can no longer contain special characters ("~\'!()*")');
+  }
+
+  if (encodeURIComponent(name) !== name) {
+    // A scope and a bare name are each URL-encoded separately, so the slash
+    // between them is legal even though it does not survive encodeURIComponent.
+    const nameMatch = name.match(scopedPackagePattern);
+    if (nameMatch) {
+      const [, user, pkg] = nameMatch;
+      if (pkg.startsWith(".")) {
+        errors.push("name cannot start with a period");
+      }
+      if (
+        encodeURIComponent(user) === user &&
+        encodeURIComponent(pkg) === pkg
+      ) {
+        return done(warnings, errors);
+      }
+    }
+    errors.push("name can only contain URL-friendly characters");
+  }
+
+  return done(warnings, errors);
+}

package/lib/third-party/arborist/lib/version-from-tgz.js

@@ -0,0 +1,51 @@
+import { basename } from "node:path";
+import { URL } from "node:url";
+
+import semver from "semver";
+
+export default (name, tgz) => {
+  const base = basename(tgz);
+  if (!base.endsWith(".tgz")) {
+    return null;
+  }
+
+  if (tgz.startsWith("http:/") || tgz.startsWith("https:/")) {
+    const u = new URL(tgz);
+    // registry url?  check for most likely pattern.
+    // either /@foo/bar/-/bar-1.2.3.tgz or
+    // /foo/-/foo-1.2.3.tgz, and fall through to
+    // basename checking.  Note that registries can
+    // be mounted below the root url, so /a/b/-/x/y/foo/-/foo-1.2.3.tgz
+    // is a potential option.
+    const tfsplit = u.pathname.slice(1).split("/-/");
+    if (tfsplit.length > 1) {
+      const afterTF = tfsplit.pop();
+      if (afterTF === base) {
+        const pre = tfsplit.pop();
+        const preSplit = pre.split(/\/|%2f/i);
+        const project = preSplit.pop();
+        const scope = preSplit.pop();
+        return versionFromBaseScopeName(base, scope, project);
+      }
+    }
+  }
+
+  const split = name.split(/\/|%2f/i);
+  const project = split.pop();
+  const scope = split.pop();
+  return versionFromBaseScopeName(base, scope, project);
+};
+
+const versionFromBaseScopeName = (base, scope, name) => {
+  if (!base.startsWith(name + "-")) {
+    return null;
+  }
+
+  const parsed = semver.parse(base.substring(name.length + 1, base.length - 4));
+  return parsed
+    ? {
+        name: scope && scope.charAt(0) === "@" ? `${scope}/${name}` : name,
+        version: parsed.version,
+      }
+    : null;
+};